Both of today's additions to the exploited catalogue were public for weeks. The deadline is three days

Twenty two days, forty five days, three days

CISA published catalogue version 2026.09.25 at 14:39 UTC today, taking the Known Exploited Vulnerabilities list to 1,725 entries. Two additions, both with a remediation deadline of 28 September, which is three days.

CVE-2026-67279 is the MikroTik RouterOS flaw: an unauthenticated client can open a session channel and send an execution request, and CISA's own description notes it can be chained to achieve unauthenticated exploitation of a second flaw. MikroTik patched it on 3 September. Public analysis of that patch appeared the following morning, and the earliest public attack logs predate the patch. Twenty two days from the fix to the catalogue.

CVE-2026-65660 is a SharePoint code injection flaw, flagged for forensic triage. Microsoft shipped it on 11 August rated 6.5 as a spoofing issue, then revised it to remote code execution at 8.8 on 27 August in a revision it described as informational. Forty five days from release to the catalogue. Twenty nine from the day the label became accurate.

What that does not establish. It does not establish that CISA was slow: the catalogue records evidence of exploitation, which arrives when it arrives, and adding an entry the day the evidence lands is the correct behaviour. It does not establish that either flaw was unexploited before today, because both were reported as exploited earlier, one of them before its patch existed. It does not establish that a three day deadline is wrong. And it does not establish anything about how many organisations are affected, because the catalogue does not carry that.

What it does establish is a gap between two clocks. The flaw becomes dangerous on one date. The obligation starts on another. Anyone whose patching is driven by the second date has been exposed for the interval between them, and today that interval is twenty two days in one case and forty five in the other.

The two records, and what came before them

The additions of 25 September 2026, with elapsed days computed for this briefing

Field	CVE-2026-67279, MikroTik	CVE-2026-65660, SharePoint
What the catalogue calls it	Improper enforcement of behavioral workflow	Code injection
CWE	CWE-841	CWE-94
Forensic triage flagged	No	Yes
Vendor fix or release	3 September	11 August
Days from that to the catalogue	22	45
Other relevant date	Public patch analysis, 4 September	Relabelled as code execution, 27 August
Deadline once catalogued	28 September, 3 days	28 September, 3 days

The SharePoint entry is the more instructive of the two, because nothing about the flaw changed between August and today. What changed was Microsoft's description of it, and then CISA's evidence that somebody was using it.

An organisation that triaged on 11 August saw a 6.5 spoofing issue. The same flaw was remote code execution at 8.8 by 27 August, in a revision Microsoft classified as informational, which is the word used for changes that do not require customer action. Anyone who did not re-read the record after that revision has now been handed a three day deadline for something they filed six weeks ago as low priority.

The MikroTik entry closes a different loop. The attacks came first, the patch second, the public analysis of the patch the next morning, and the catalogue three weeks later. By the time the obligation existed, the chain had been described publicly in detail.

September's shape

With today's release, September 2026 stands at 38 additions to the catalogue. Computing the difference between dateAdded and dueDate for each gives exactly two values: three days for 30 of them, and fourteen days for the other 8. No other deadline appears.

That is 78.9 per cent on the short clock, in a month where the short clock was introduced as the exception for the most serious cases. This site reported 34 and 26 yesterday morning, and 36 and 28 yesterday evening. The proportion is climbing as the month runs out.

What a lagging indicator with an urgent clock actually asks of you

The catalogue is a record of evidence, not a warning system. It says somebody has been seen using this. That is a different statement from this is dangerous, and it necessarily arrives later.

Used correctly, it is excellent: a short, curated list of things that are definitely being exploited, with a deadline attached for the organisations bound by the directive. Used as a trigger, it guarantees you are always behind, and today's two entries show by how much.

There is a second failure mode visible in the SharePoint case, and it is entirely within your control. Vendor records change. A severity is revised, a title is corrected, an impact class is updated, and the revision is marked informational because no new patch is required. If your process reads a vendor record once, at triage, you will not see any of that. The flaw you filed in August as a 6.5 was an 8.8 by the end of the month, and nobody told you.

The question this leaves

There is an easy criticism available here and it is the wrong one. CISA is not late. It catalogues what it can evidence, and a catalogue that waited for certainty about impact would be less useful, not more.

The uncomfortable part is what the gap implies about everybody else's process. Two flaws entered the list today. One had been patched for three weeks with a public analysis of the patch available the next morning. The other had carried the wrong severity label for sixteen days and the right one for twenty nine. In both cases the information needed to act was available, in public, long before the obligation arrived.

So the question is not whether you can meet a three day deadline. It is this: for the flaw that will be catalogued in three weeks' time, what would have told you today, and are you reading it?